Microsoft Sentinel EPS & Log Size Calculator v2.0

Review the below Explainer video and accordingly please fill in the number of Devices for each of the sections and this calculator will automatically calculate its EPS (Events Per Second) and Storage Requirements
Note: We do not store or track any of this data on our server, this is all stored on your local browser cache.

Network Firewalls (Layer 7 Internal)
   Network Firewalls (Layer 7 - DMZ)
   Network Firewalls (Internal)
   Network Firewalls (DMZ)
   Windows Servers - HIGH EPS (Event Log)
   Windows Servers - MED EPS (Event Log)
   Windows Servers - LOW EPS (Event Log)
   Network Switches
   Other Network Devices
   Windows Clients (PCs / Tablets / POS)
   Linux Servers
   Network Routers
   Network Flows (NetFlow/S-Flow)
   Network Wireless LAN
   Network Load-Balancers
   Other Security Devices
   Network IPS/IDS
   Network VPN / SSL VPN
   Network Web Proxy
   HyperVisor (ESXi, Hyper-V etc)
   Azure Activity Logs (Direct Connect)
        Azure AD Identity Protection (Direct Connect)
        Office 365 (Direct Connect)
        Azure Defender (Direct Connect)
        Azure Defender for IoT (Direct Connect)
        Microsoft 365 Defender (Direct Connect)
        Microsoft Defender for Endpoint (Direct Connect)
        Microsoft Defender for Identity (Direct Connect)
        Microsoft Cloud App Security (Direct Connect)
        Some of the data connectors, such as Microsoft 365 Defender and MCAS, include both free and paid data types. Read this Document to know more.
Total Devices:
Total EPS:
Total GB/Day:
Estimated Bandwidth:
90 Days:
180 Days:

Please click here to download this data.
To download this data please use a PC.

Download Chart

To download this chart please use a PC.

By viewing and utilizing the Azure Sentinel Sizing Calculator, you acknowledge that you have read, understood and agreed to this Disclaimer.

Frequently Asked Questions

Tool URL:

What is Azure Sentinel?

Azure Pricing Calculator

Azure Sentinel ROI Estimator

Any Questions? Connect with my LinkedIn Profile:

My Blog URL:

Last Updated: 03 Feb 2022


  1. This is amazing. How do you estimate the EPS based on the device type? Are those industry figures or your best professional estimate?

  2. This is awesome, thank you for sharing

  3. Brilliant tool!

    One question - Data from Azure / MS365 does not seem to be calculated into Sentinel usage?
    How does one calculate usage for only ingesting Azure / MS365 data?


Post a Comment

Popular posts from this blog

Threat Hunting in Microsoft Sentinel (part 1)

Work with String Data Using KQL Statements

Operational Tasks for Microsoft Sentinel